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This is in response to the appeal brief filed 30 October 2008 appealing from the Office 
action mailed 1 1 July 2008. 

(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in 
the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or 
judicial proceedings which will directly affect or be directly affected by or have a 
bearing on the Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 
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(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on 
appeal is correct. 



(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is 
correct. 



(8) Evidence Relied Upon 

2003/0200486 Marwaha 10-2003 

6,584,502 Natarajan et al. 6-2003 



(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 



1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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2. Claims 1, 3-5, 8 and 10-11 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marwaha (US 2003/0200486), hereinafter Marwaha, in view of 
Natarajan et al. (US 6,584,502 B1), hereinafter Natarajan. 

3. With respect to Claim 1 , Marwaha disclosed: "A method of generating events 
having a common event format (Page 14, Paragraph [0011], lines 1-4), comprising: 

associating a content handler with the event factory (Figure 3, objects 304a, b 
and c, and [0030], lines 7-9, the table below this and Paragraph [0031], lines 1-2, where 
a content handler is the CEF translator and the event factory is the Listener/Receiver); 

obtaining a common base event associated with the content handler ([0028], 
lines 1-5, Figure 3, objects 304a, b and c); 

populating the common base event with source specific situation information to 
provide a populated base event ([0026], line 5, "object", defined later to be "To identify 
the affected component", Page 15, 1st Col., under the Object heading); 

determining if a format of the populated common base event conforms to a 
predefined event format ([0025], lines 8-1 1 , where during data normalization the event 
format may be updated, shown by [0027], lines 1-3, the data normalization phase 
determines if the format is acceptable, and if not updates the format, see Pg 14, the 
table below [0027], specifically "OriginDateTime", Remarks "If the original date/time is 
present, then that may be used"), wherein the predefined event format is defined by the 
content handler ([0025], lines 8-1 1 , where the data normalization transformer gathers 
the predefined information such as source, type, and status); and 
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generating a common event format representation of the populated base event 
based on the predefined event format if the format of the populated base event does not 
conform to the predefined event format ([0027], lines 1-3)". 

Marwaha did not explicitly state: "associating an event factory with a directory 
service; locating the event factory using the directory service" or "returning the 
populated base event incorporated in the content handler from the event factory to the 
event source". 

However, Natarajan disclosed: "associating an event factory with a directory 
service (Col. 26, lines 6-10); locating the event factory using the directory service (Col. 
26, lines 6-10)" or "returning the populated base event incorporated in the content 
handler from the event factory to the event source (Col. 7, lines 27-30, where the event 
information was reported to a policy engine, updated, and is sent back to selected 
network elements)". 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to modify the event notification of Marwaha with the teachings of Natarajan to 
include using a directory service to locate the event factory. Motivation to combine 
these references comes from the function of a directory service itself. Directory 
services are provided to store and organize information regarding a network, such as 
mapping network addresses to names of their respective network devices, relieving 
users from using unfriendly network addresses. Combining the event notification of 
Marwaha with the location of the event factory using a directory service of Natarajan 
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therefore creates a more user friendly experience by allowing the user to specify a 
name rather than a network address. 

Also, it would have been obvious to one of ordinary skill in the art at the time of 
the invention to modify the event notification of Marwaha with the teachings of Natarajan 
to include sending the information back to the source. Motivation comes from 
Natarajan, "The updated control information is fed back to selected network elements to 
thereby affect operation of the selected elements" (Abstract, lines 9-1 1 ). By combining 
the event notification of Marwaha with sending information back to the source of 
Natarajan, the event notification system can affect operation of the elements based on 
event notification data. 

4. With respect to Claim 3, the combination of Marwaha and Natarajan disclosed: 
"The method of claim 1 , wherein the source specific situation information is provided in 
a plurality of event fields (Marwaha, [0026], lines 2-7) and wherein generating a 
common event format representation of the populated base event comprises: 

determining if ones of the plurality of event fields conform to the predefined event 
format defined by the content handler (Marwaha, [0017], lines 1-3, "The following tables 
show examples of tokens and their values that may be updated", if the value are to be 
updated, they are checked against some standard, see [0030], lines 1-5); 

modifying the format of the ones of the plurality of event fields that do not 
conform to the predefined event format (Marwaha, [0017], lines 1-3, "The following 
tables show examples of tokens and their values that may be updated"); 
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determining if ones of the plurality of event fields are empty (Marwaha, [0027], 
lines 1-3, "The following tables show examples of tokens and their values that may be 
updated or assigned values", assigning a value implies the value was not present during 
an inspection stage); and 

populating the empty ones of the plurality of event fields with source specific 
situation information based on the predefined event format (Marwaha, [0027], lines 1-3, 
"The following tables show examples of tokens and their values that may be updated or 
assigned values")". 

5. With respect to Claim 4, the combination of Marwaha and Natarajan disclosed: 
"The method of claim 3, further comprising: 

providing the common event format representation of the populated base event 
to an event server (Marwaha, [0037], lines 1-2); and 

storing the common event format representation of the populated base event in a 
data store at the event server (Marwaha, [0038], lines 1-3)". 

6. With respect to Claim 5, the combination of Marwaha and Natarajan disclosed: 
"The method of claim 4 further comprising: 

querying the event server to obtain status information of a system associated 
with the event source based on the stored common event format representation of the 
populated base event (Marwaha, [0045], lines 10-13)". 
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7. With respect to Claim 8, the combination of Marwaha and Natarajan disclosed: 
"The method of claim 1 , wherein the directory service comprises a Java Naming and 
Directory(JNDI) service (Natarajan, Col. 26, lines 6-10)". 

8. With respect to Claim 10, the combination of Marwaha and Natarajan disclosed: 
"The method of claim 1 , wherein the populated base event comprises a date and/or time 
stamp (Marwaha, [0026], lines 3-7, the "OriginDateTime", further defined below as "The 
date/time that the event occurred at the origin" Page 14, 2nd Col., under the 
OriginDateTime heading), a situation type (Marwaha, [0026], lines 3-7, the 
"ObjectClass", further defined below as "The category to which the object belongs" 
Page 15, 1st Col. Under the heading "ObjectClass"), an identity of the event source 
and/or an identity of a component reporting the situation type (Marwaha, [0026], lines 3- 
7, the "Object", further defined below as "The affected component for which the event 
was generated" Page 15, 1st Col. Under the heading "Object")". 

9. With respect to Claim 1 1 , the combination of Marwaha and Natarajan disclosed: 
"The method of claim 1 , wherein generating comprises automatically generating a 
common event format representation of the populated base event based on the 
predefined event format (Marwaha, [0027], lines 1-3)". 



Application/Control Number: 10/809,175 Page 9 

Art Unit: 2451 

(10) Response to Argument 

The examiner summarizes the various points raised by appellant and 
addresses replies individually. 

Appellant argued that: 

(1 ) "Appellants submit that Marwaha . . . merely discloses converting a 
received event to a common event format, irrespective of a format of the received 
event" (pg 3, Independent Claim 1 , lines 1-3). 

In reply to argument (1 ): Examiner respectfully disagrees, Marwaha disclosed: "a 
common event format includes a set of tokens and their values" ([001 1 ], lines 4-5). The 
common event format therefore includes certain tokens and their values. One such 
token that can be included in a common event format is OriginDateTime (see [0027] 
and table below). The table below [0027] specifically states, in regard to 
OriginDateTime: "If the original date/time is present then that value may be used" (table 
below [0027], OriginDateTime, Remarks section). The common event format includes 
tokens and their values, the OriginDateTime being one such token, and the original 
date/time may be used if it is present, the system of Marwaha therefore does not 
convert a received event into a common event format, irrespective of the received 
event. 

With respect to [0027] Appellant has stated: "Appellants submit the remarks 
mean if the original date/time (provided by an event) is present the value may be used 
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or a date/time added by a connecting agent may be used (e.g., when the event 
originator has not included an original date/time for an event)". Since common event 
format includes tokens and their values, and the origin date/time can be one such token, 
appellant has therefore submitted that if the origin date/time is present, then that value 
may be used and Marwaha does not convert a received event into a common event 
format irrespective of a format of the received event. 

Furthermore Appellant argues: "As specifically noted in Marwaha paragraph 
[0028], a common event format (CEF) translator is utilized to extract the tokens and 
format information in the tokens in a common event format" (pg 5, lines 10-12). 
Examiner respectfully disagrees, while Marwaha disclosed the CEF translators 
extracting the tokens, Marwaha does not disclose formatting the information in the 
tokens. Specifically Marwaha disclosed: "listener or receiver ... receives messages and 
a normalizing process, for example, one or more CEF translators 304a, 304b, 304c, 
extracts the above desired tokens and assigns an index to the alert". ([0028], lines 1-5). 

(2) "Appellants submit that Natarajan also does not teach or suggest (alone or 
in combination with Marwaha) a method that employs an event source (e.g., 305) that 
accesses an event factory (e.g., 300) to obtain a common base event (e.g., 340) that is 
populated and returned to the event source (in the form of a populated base event 
incorporated in a content handler)" (pg 5, lines 19-23). 
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In reply to argument (2): on page 6 of the appeal brief, appellant specifically 
states: "Appellants submit that while policy engine 254 may feed control information to 
network elements 204, this does not teach or suggest an event source that accesses an 
event factory to obtain a common base event" (pg 6, lines 16-17). Examiner submits 
that the claim language does not include an event source that accesses an event 
factory to obtain a common base event and therefore this argument is moot. 

Furthermore, Appellant argues: "the Examiner appears to erroneously equate the 
Natarajan policy engine with Appellants' event factory" (pg 6, lines 11-12). Examiner 
respectfully disagrees, while Natarajan may use the name policy engine and Appellant 
uses the name event factory, they exhibit the same functionality. The event source in 
Natarajan is a network element which reports information (or events) to the event 
factory or policy engine (see Natarajan Col. 8, lines 39-51). The policy engine 
populates the event by adding source specific situation information to provide a 
populated base event (Natarajan, Col. 8, lines 47-51 , where the reported event is 
updated with source specific situation information to affect performance of the network). 
Then, the policy engine returns the populated base event incorporated in the content 
handler from the event factory (policy engine) to the event source (network element) 
(Natarajan, Col. 8, lines 47-51 , where the reported event is fed back to the desired 
network elements). 

Appellant further argues: "Natarajan merely discloses providing control 
information (from a policy engine) to a network element based on information reported 
by the network element (to the policy engine)" (pg 6, lines 18-20). Examiner respectfully 
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disagrees, Natarajan disclosed: "examples of the network information reported by the 
network element include... any of the above described parameters may be dynamically 
and automatically modified or updated by the policy engine and fed back to the desired 
network elements" (Col. 8, lines 39-50). This section lists example information reported 
by Natarajan. The reported information is an event. According to the IEEE 
Authoritative Dictionary of IEEE Standards Terms, an event is: "Any change in 
conditions or performance of interest" (IEEE, pg 398, event, (6) (A)). Therefore the 
reported information of Natarajan, such as number of packets dropped (Col. 8, line 45), 
is an event. Furthermore, by updating the information, or event, to affect operation or 
performance of the network, the policy engine populates the event with source specific 
situation information. 

(3) "Moreover, it is still unclear to Appellants why one of ordinary skill in the 
art would be motivated by the combination of Marwaha and Natarajan to send a 
populated base event from an event factory to an event source" (pg 6, lines 21-23). 

In reply to argument (3): on page 7 of the appeal brief Appellant states: "the 
Examiner appears to confuse control information with a populated base event" (pg 7, 
lines 10-11). Examiner respectfully disagrees. Natarajan disclosed reporting 
information to a policy engine in Col. 8, lines 39-51 . The reported information is an 
event, as evidenced above with respect to the IEEE Authoritative Dictionary of IEEE 
Standards Terms. Therefore by updating the reported information, or event, the policy 
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engine is populating the event with source specific situation information. The updated 
information is source specific situation information because the updated, or populated 
event, is sent back to the desired network elements to affect the performance of the 
network. The motivation to combine these references comes from being able to 
dynamically affect the operation or performance of the network. 

(4) "Appellants submit that dependent claims 3-5, 8, 10, and 1 1 are also 
allowable for at least the reason that the claims depend on allowable claims" (pg 7, 
Dependent Claims 3-5, 8, 1 0, and 11 , lines 1 -2). 

In reply to argument (4): Examiner respectfully disagrees; see above rejections 
and responses to arguments. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner 
in the Related Appeals and Interferences section of this examiner's answer. 
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(12) Conclusion 

For the above reasons, it is believed that the rejections should be 
sustained. 

Respectfully submitted, 
Matthew Lindsey 
/M.L./ 

/John Follansbee/ 
Supervisory Patent Examiner, Art Unit 2451 
Conferees: 
/Jeffrey Pwu/ 

Supervisory Patent Examiner, Art Unit 2446 
/John Follansbee/ 
Supervisory Patent Examiner, Art Unit 2451 



